diff --git a/packages/client/src/client/auth.ts b/packages/client/src/client/auth.ts
index 4c37339297..b9b989409c 100644
--- a/packages/client/src/client/auth.ts
+++ b/packages/client/src/client/auth.ts
@@ -866,7 +866,8 @@ function isLoopbackHost(hostname: string): boolean {
 }
 
 /**
- * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint.
+ * Refuses to send credentials to a non-TLS, non-loopback token endpoint
+ * (MCP authorization spec, OAuth 2.1 §1.5).
  * Throws {@linkcode InsecureTokenEndpointError}. Loopback hosts are exempt.
  */
 export function assertSecureTokenEndpoint(tokenEndpoint: string | URL): URL {
diff --git a/packages/client/src/client/authErrors.ts b/packages/client/src/client/authErrors.ts
index e8925b2f86..5912c47536 100644
--- a/packages/client/src/client/authErrors.ts
+++ b/packages/client/src/client/authErrors.ts
@@ -132,7 +132,8 @@ export class RegistrationRejectedError extends OAuthClientFlowError {
 
 /**
  * Thrown by the token-exchange and refresh paths when the resolved token
- * endpoint is not `https:` and is not a loopback host (SEP-2207). This is a
+ * endpoint is not `https:` and is not a loopback host (MCP authorization spec,
+ * OAuth 2.1 §1.5). This is a
  * configuration error — re-authorizing cannot fix it — so it intentionally does
  * **not** extend `OAuthError` and `auth()`'s refresh branch rethrows it instead
  * of falling through to a fresh `/authorize` redirect.